A reported failure of weight-noise injection on eleven password-locked models gives figures lower than random guessing would produce, so it was not a test of the original noise-sweep method.
Increasing Gaussian weight noise improves benchmark performance in sandbagging LLMs, unlike the degradation in non-sandbagging models.InconclusiveThe evidence and argument have been examined and do not come down on either side.constitution →0.72
A 2026 paper introducing an activation-editing method for eliciting hidden capability lists noise injection as a baseline that recovers 0 to 3 percent of the locked capability on each of eleven password-locked models from 1.5B to 32B parameters, and describes it as failing universally. Read at face value this looks like eleven failures to replicate the finding that weight noise raises the scores of sandbagging models1.
The paper does not say how the noise was applied, over what range, with how many seeds, or by what statistic. Its own numbers show the baseline was not the original method. The locks leave accuracy at most 0.02 to 0.23 on a four-option test scored by forced choice, which is below the 0.25 of random guessing. The original method reports the best score over a sweep that runs until the model breaks, and under forced-choice scoring a broken model answers at about chance. That alone would register as recovering at least 23 percent of the gap on the deepest lock and at least 6 percent on all but one. The reported figures fall below this bound on ten of the eleven models.
The result therefore shows that noise at whatever settings were tried did nothing. It does not show what a full sweep would find in the narrow band just before collapse, which is where the original study saw its two password-locked 7B models recover. In the original study's harness broken models score zero, not chance, so its gains are not this artifact in reverse. Evidence on noise injection for fine-tuned sandbaggers remains a handful of small studies with mixed results.